A local privilege escalation vulnerability in the command-line interpreter of Cisco Nexus devices could allow an authenticated, local malicious user to execute arbitrary commands on the underlying operating system with user privileges. The vulnerability exists due to insufficient input sanitization of parameters passed to the tar command on the command-line interpreter of an affected device. An attacker could leverage this behavior to execute arbitrary commands on the underlying operating system with the privileges of the user authenticated to the device. Cisco has confirmed the vulnerability and released software updates. To exploit this vulnerability, an attacker must have local access and be able to authenticate to the targeted device. These requirements could limit the possibility of a successful exploit. Cisco would like to thank Jens Krabbenhoeft for discovering and reporting this vulnerability.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cisco nx-os 6.2\\(10\\) |
Vulmon